
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="zh_Hans">
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <title>执行原生 SQL 查询 &#8212; Django 3.2.11.dev 文档</title>
    <link rel="stylesheet" href="../../_static/default.css" type="text/css" />
    <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
    <script type="text/javascript" id="documentation_options" data-url_root="../../" src="../../_static/documentation_options.js"></script>
    <script type="text/javascript" src="../../_static/jquery.js"></script>
    <script type="text/javascript" src="../../_static/underscore.js"></script>
    <script type="text/javascript" src="../../_static/doctools.js"></script>
    <script type="text/javascript" src="../../_static/language_data.js"></script>
    <link rel="index" title="索引" href="../../genindex.html" />
    <link rel="search" title="搜索" href="../../search.html" />
    <link rel="next" title="数据库事务" href="transactions.html" />
    <link rel="prev" title="管理器" href="managers.html" />



 
<script src="../../templatebuiltins.js"></script>
<script>
(function($) {
    if (!django_template_builtins) {
       // templatebuiltins.js missing, do nothing.
       return;
    }
    $(document).ready(function() {
        // Hyperlink Django template tags and filters
        var base = "../../ref/templates/builtins.html";
        if (base == "#") {
            // Special case for builtins.html itself
            base = "";
        }
        // Tags are keywords, class '.k'
        $("div.highlight\\-html\\+django span.k").each(function(i, elem) {
             var tagname = $(elem).text();
             if ($.inArray(tagname, django_template_builtins.ttags) != -1) {
                 var fragment = tagname.replace(/_/, '-');
                 $(elem).html("<a href='" + base + "#" + fragment + "'>" + tagname + "</a>");
             }
        });
        // Filters are functions, class '.nf'
        $("div.highlight\\-html\\+django span.nf").each(function(i, elem) {
             var filtername = $(elem).text();
             if ($.inArray(filtername, django_template_builtins.tfilters) != -1) {
                 var fragment = filtername.replace(/_/, '-');
                 $(elem).html("<a href='" + base + "#" + fragment + "'>" + filtername + "</a>");
             }
        });
    });
})(jQuery);</script>

  </head><body>

    <div class="document">
  <div id="custom-doc" class="yui-t6">
    <div id="hd">
      <h1><a href="../../index.html">Django 3.2.11.dev 文档</a></h1>
      <div id="global-nav">
        <a title="Home page" href="../../index.html">Home</a>  |
        <a title="Table of contents" href="../../contents.html">Table of contents</a>  |
        <a title="Global index" href="../../genindex.html">Index</a>  |
        <a title="Module index" href="../../py-modindex.html">Modules</a>
      </div>
      <div class="nav">
    &laquo; <a href="managers.html" title="管理器">previous</a>
     |
    <a href="../index.html" title="使用 Django" accesskey="U">up</a>
   |
    <a href="transactions.html" title="数据库事务">next</a> &raquo;</div>
    </div>

    <div id="bd">
      <div id="yui-main">
        <div class="yui-b">
          <div class="yui-g" id="topics-db-sql">
            
  <div class="section" id="s-performing-raw-sql-queries">
<span id="performing-raw-sql-queries"></span><h1>执行原生 SQL 查询<a class="headerlink" href="#performing-raw-sql-queries" title="永久链接至标题">¶</a></h1>
<p>Django 允许你用两种方式执行原生 SQL 查询：你可以使用 <a class="reference internal" href="#django.db.models.Manager.raw" title="django.db.models.Manager.raw"><code class="xref py py-meth docutils literal notranslate"><span class="pre">Manager.raw()</span></code></a> 来 <a class="reference internal" href="#performing-raw-queries">执行原生查询并返回模型实例</a>，或者完全不用模型层  <a class="reference internal" href="#executing-custom-sql-directly">直接执行自定义 SQL</a>。</p>
<div class="admonition-explore-the-orm-before-using-raw-sql admonition">
<p class="first admonition-title">在使用原生 SQL 之前探索 ORM！</p>
<p>Django ORM 提供了很多工具，允许你在不编写原生 SQL 的情况下表达查询。例如：</p>
<ul class="simple">
<li><a class="reference internal" href="../../ref/models/querysets.html"><span class="doc">QuerySet API</span></a> 覆盖面很广。</li>
<li>你可以用很多内置的 <a class="reference internal" href="../../ref/models/database-functions.html"><span class="doc">数据库函数</span></a> 进行 <a class="reference internal" href="../../ref/models/querysets.html#django.db.models.query.QuerySet.annotate" title="django.db.models.query.QuerySet.annotate"><code class="xref py py-meth docutils literal notranslate"><span class="pre">annotate</span></code></a> 和 <a class="reference internal" href="aggregation.html"><span class="doc">aggregate</span></a>。除此之外，你还可以创建 <a class="reference internal" href="../../ref/models/expressions.html"><span class="doc">查询表达式</span></a>。</li>
</ul>
<p class="last">Before using raw SQL, explore <a class="reference internal" href="index.html"><span class="doc">the ORM</span></a>. Ask on
one of <a class="reference internal" href="../../faq/help.html"><span class="doc">the support channels</span></a> to see if the ORM supports
your use case.</p>
</div>
<div class="admonition warning">
<p class="first admonition-title">警告</p>
<p class="last">无论何时编写原生 SQL 都要万分小心。使用时，你要用 <code class="docutils literal notranslate"><span class="pre">params</span></code> 将任何用户传入的参数进行安全转义，避免 SQL 注入攻击。阅读 <a class="reference internal" href="../security.html#sql-injection-protection"><span class="std std-ref">SQL 注入保护</span></a> 了解更多。</p>
</div>
<div class="section" id="s-performing-raw-queries">
<span id="s-executing-raw-queries"></span><span id="performing-raw-queries"></span><span id="executing-raw-queries"></span><h2>执行原生查询<a class="headerlink" href="#performing-raw-queries" title="永久链接至标题">¶</a></h2>
<p>若管理器方法 <code class="docutils literal notranslate"><span class="pre">raw()</span></code> 能用于执行原生 SQL 查询，就会返回模型实例：</p>
<dl class="method">
<dt id="django.db.models.Manager.raw">
<code class="descclassname">Manager.</code><code class="descname">raw</code>(<em>raw_query</em>, <em>params=()</em>, <em>translations=None</em>)<a class="headerlink" href="#django.db.models.Manager.raw" title="永久链接至目标">¶</a></dt>
<dd></dd></dl>

<p>该方法接受一个原生 SQL 查询语句，执行它，并返回一个 <code class="docutils literal notranslate"><span class="pre">django.db.models.query.RawQuerySet</span></code> 实例。这个 <code class="docutils literal notranslate"><span class="pre">RawQuerySet</span></code> 能像普通的 <a class="reference internal" href="../../ref/models/querysets.html#django.db.models.query.QuerySet" title="django.db.models.query.QuerySet"><code class="xref py py-class docutils literal notranslate"><span class="pre">QuerySet</span></code></a> 一样被迭代获取对象实例。</p>
<p>最好用例子来解释。假设你有以下模型:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">class</span> <span class="nc">Person</span><span class="p">(</span><span class="n">models</span><span class="o">.</span><span class="n">Model</span><span class="p">):</span>
    <span class="n">first_name</span> <span class="o">=</span> <span class="n">models</span><span class="o">.</span><span class="n">CharField</span><span class="p">(</span><span class="o">...</span><span class="p">)</span>
    <span class="n">last_name</span> <span class="o">=</span> <span class="n">models</span><span class="o">.</span><span class="n">CharField</span><span class="p">(</span><span class="o">...</span><span class="p">)</span>
    <span class="n">birth_date</span> <span class="o">=</span> <span class="n">models</span><span class="o">.</span><span class="n">DateField</span><span class="p">(</span><span class="o">...</span><span class="p">)</span>
</pre></div>
</div>
<p>然后你可以像这样执行自定义 SQL:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT * FROM myapp_person&#39;</span><span class="p">):</span>
<span class="gp">... </span>    <span class="nb">print</span><span class="p">(</span><span class="n">p</span><span class="p">)</span>
<span class="go">John Smith</span>
<span class="go">Jane Jones</span>
</pre></div>
</div>
<p>这个例子并不令人激动——它与运行 <code class="docutils literal notranslate"><span class="pre">Person.objects.all()</span></code> 完全相同。然而， <code class="docutils literal notranslate"><span class="pre">raw()</span></code> 有很多额外选项，使得它非常强大。</p>
<div class="admonition-model-table-names admonition">
<p class="first admonition-title">模型表名</p>
<p>在本例中， <code class="docutils literal notranslate"><span class="pre">Person</span></code> 表的名称是从哪来的？</p>
<p>默认情况下，Django 通过拼接模型的 &quot;app label&quot; 和模型类名推算出数据表名 —— 即你在 <code class="docutils literal notranslate"><span class="pre">manage.py</span> <span class="pre">startapp</span></code> 中使用的名称，二者以一个下划线分割。在本例中，我们假定 <code class="docutils literal notranslate"><span class="pre">Person</span></code> 模型位于一个叫做 <code class="docutils literal notranslate"><span class="pre">myapp</span></code> 的应用中，这样，模型的表名就是 <code class="docutils literal notranslate"><span class="pre">myapp_person</span></code>。</p>
<p class="last">更多细节请查阅关于 <a class="reference internal" href="../../ref/models/options.html#django.db.models.Options.db_table" title="django.db.models.Options.db_table"><code class="xref py py-attr docutils literal notranslate"><span class="pre">db_table</span></code></a> 选项的文档，它也允许你手动指定数据库的表名。</p>
</div>
<div class="admonition warning">
<p class="first admonition-title">警告</p>
<p class="last">不会对传给 <code class="docutils literal notranslate"><span class="pre">.raw()</span></code> 的 SQL 语句做任何检查。Django 期望该语句会从数据库中返回一个集合，但并不强制如此。若该查询没有返回一些记录，会导致一个（含糊）的错误。</p>
</div>
<div class="admonition warning">
<p class="first admonition-title">警告</p>
<p class="last">若你在 MySQL 上执行查询，至于其无声的强制类型可能会弄混类型时导致不可预料的后果。若你用一个整数值查询一个字符串列，MySQL 会执行比较前将表中所有数据强制转为整数。例如，若数据表包含的值有 <code class="docutils literal notranslate"><span class="pre">'abc'</span></code> 和 <code class="docutils literal notranslate"><span class="pre">'def'</span></code>，而查询语句为 <code class="docutils literal notranslate"><span class="pre">WHERE</span> <span class="pre">mycolumn=0</span></code>，这两行都会匹配上。要避免这种情况，在将值传给查询语句前进行合适的类型转换。</p>
</div>
<div class="versionchanged">
<span class="title">Changed in Django 3.2:</span> <p>The default value of the <code class="docutils literal notranslate"><span class="pre">params</span></code> argument was changed from <code class="docutils literal notranslate"><span class="pre">None</span></code> to
an empty tuple.</p>
</div>
<div class="section" id="s-mapping-query-fields-to-model-fields">
<span id="mapping-query-fields-to-model-fields"></span><h3>将查询字段映射为模型字段<a class="headerlink" href="#mapping-query-fields-to-model-fields" title="永久链接至标题">¶</a></h3>
<p><code class="docutils literal notranslate"><span class="pre">raw()</span></code> 字段将查询语句中的字段映射至模型中的字段。</p>
<p>查询语句中的字段排序并不重要。换而言之，以下两种查询是一致的:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT id, first_name, last_name, birth_date FROM myapp_person&#39;</span><span class="p">)</span>
<span class="gp">...</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT last_name, birth_date, first_name, id FROM myapp_person&#39;</span><span class="p">)</span>
<span class="gp">...</span>
</pre></div>
</div>
<p>匹配是根据名字来的。这意味着你可以使用 SQL 的 <code class="docutils literal notranslate"><span class="pre">AS</span></code> 子句将查询语句中的字段映射至模型中的字段。所以，若你还有一些数据表包含了 <code class="docutils literal notranslate"><span class="pre">Person</span></code> 数据，你可以很方便的将其映射至 <code class="docutils literal notranslate"><span class="pre">Person</span></code> 实例:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;&#39;&#39;SELECT first AS first_name,</span>
<span class="gp">... </span><span class="s1">                             last AS last_name,</span>
<span class="gp">... </span><span class="s1">                             bd AS birth_date,</span>
<span class="gp">... </span><span class="s1">                             pk AS id,</span>
<span class="gp">... </span><span class="s1">                      FROM some_other_table&#39;&#39;&#39;</span><span class="p">)</span>
</pre></div>
</div>
<p>只要名字对上了，模型实例就会被正确创建。</p>
<p>或者，你可以用 <code class="docutils literal notranslate"><span class="pre">raw()</span></code> 的 <code class="docutils literal notranslate"><span class="pre">translations</span></code> 参数将查询语句中的字段映射至模型中的字段。这是一个字典，将查询语句中的字段名映射至模型中的字段名。例如，上面的查询也能这样写:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">name_map</span> <span class="o">=</span> <span class="p">{</span><span class="s1">&#39;first&#39;</span><span class="p">:</span> <span class="s1">&#39;first_name&#39;</span><span class="p">,</span> <span class="s1">&#39;last&#39;</span><span class="p">:</span> <span class="s1">&#39;last_name&#39;</span><span class="p">,</span> <span class="s1">&#39;bd&#39;</span><span class="p">:</span> <span class="s1">&#39;birth_date&#39;</span><span class="p">,</span> <span class="s1">&#39;pk&#39;</span><span class="p">:</span> <span class="s1">&#39;id&#39;</span><span class="p">}</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT * FROM some_other_table&#39;</span><span class="p">,</span> <span class="n">translations</span><span class="o">=</span><span class="n">name_map</span><span class="p">)</span>
</pre></div>
</div>
</div>
<div class="section" id="s-index-lookups">
<span id="index-lookups"></span><h3>索引查询<a class="headerlink" href="#index-lookups" title="永久链接至标题">¶</a></h3>
<p><code class="docutils literal notranslate"><span class="pre">raw()</span></code> 支持索引，所以，若你只需要第一个结果就这样写:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">first_person</span> <span class="o">=</span> <span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT * FROM myapp_person&#39;</span><span class="p">)[</span><span class="mi">0</span><span class="p">]</span>
</pre></div>
</div>
<p>不过，索引和切片不是在数据库层面上实现的。若数据库中有非常多的 <code class="docutils literal notranslate"><span class="pre">Person</span></code> 对象，更搞笑的方式是在 SQL 层面使用 limit 子句:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">first_person</span> <span class="o">=</span> <span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT * FROM myapp_person LIMIT 1&#39;</span><span class="p">)[</span><span class="mi">0</span><span class="p">]</span>
</pre></div>
</div>
</div>
<div class="section" id="s-deferring-model-fields">
<span id="deferring-model-fields"></span><h3>延迟模型字段<a class="headerlink" href="#deferring-model-fields" title="永久链接至标题">¶</a></h3>
<p>也可以省略字段:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">people</span> <span class="o">=</span> <span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT id, first_name FROM myapp_person&#39;</span><span class="p">)</span>
</pre></div>
</div>
<p>该查询返回的 <code class="docutils literal notranslate"><span class="pre">Person</span></code> 对象即延迟模型实例（参考 <a class="reference internal" href="../../ref/models/querysets.html#django.db.models.query.QuerySet.defer" title="django.db.models.query.QuerySet.defer"><code class="xref py py-meth docutils literal notranslate"><span class="pre">defer()</span></code></a>）。这意味着查询语句中省略的字段按需加载。例子:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT id, first_name FROM myapp_person&#39;</span><span class="p">):</span>
<span class="gp">... </span>    <span class="nb">print</span><span class="p">(</span><span class="n">p</span><span class="o">.</span><span class="n">first_name</span><span class="p">,</span> <span class="c1"># This will be retrieved by the original query</span>
<span class="gp">... </span>          <span class="n">p</span><span class="o">.</span><span class="n">last_name</span><span class="p">)</span> <span class="c1"># This will be retrieved on demand</span>
<span class="gp">...</span>
<span class="go">John Smith</span>
<span class="go">Jane Jones</span>
</pre></div>
</div>
<p>表面上，看起来该查询同时检出了 first name 和 last name。然而，这个例子实际上执行了三次查询。只有 first names 是由 raw() 查询检出的 —— last names 是在它们被打印时按需检出。</p>
<p>只有一个字段你不能省略 —— 主键字段。Django 用主键来区分模型实例，所以必须在原生查询语句中包含主键。若你忘了包含主键会抛出 <a class="reference internal" href="../../ref/exceptions.html#django.core.exceptions.FieldDoesNotExist" title="django.core.exceptions.FieldDoesNotExist"><code class="xref py py-class docutils literal notranslate"><span class="pre">FieldDoesNotExist</span></code></a>  异常。</p>
</div>
<div class="section" id="s-adding-annotations">
<span id="adding-annotations"></span><h3>添加注释<a class="headerlink" href="#adding-annotations" title="永久链接至标题">¶</a></h3>
<p>你可以执行带有模型中未定义字段的查询语句。例如，我们能用 <a class="reference external" href="https://www.postgresql.org/docs/current/functions-datetime.html">PostgreSQL 的 age() 函数</a> 获取用户列表，他们的年龄已由数据库计算:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">people</span> <span class="o">=</span> <span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT *, age(birth_date) AS age FROM myapp_person&#39;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">people</span><span class="p">:</span>
<span class="gp">... </span>    <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">%s</span><span class="s2"> is </span><span class="si">%s</span><span class="s2">.&quot;</span> <span class="o">%</span> <span class="p">(</span><span class="n">p</span><span class="o">.</span><span class="n">first_name</span><span class="p">,</span> <span class="n">p</span><span class="o">.</span><span class="n">age</span><span class="p">))</span>
<span class="go">John is 37.</span>
<span class="go">Jane is 42.</span>
<span class="gp">...</span>
</pre></div>
</div>
<p>你总是可以用 <a class="reference internal" href="../../ref/models/expressions.html#func-expressions"><span class="std std-ref">Func() 表达式</span></a> 避免使用原生 SQL 去计算注释。</p>
</div>
<div class="section" id="s-passing-parameters-into-raw">
<span id="passing-parameters-into-raw"></span><h3>将参数传给 <code class="docutils literal notranslate"><span class="pre">raw()</span></code><a class="headerlink" href="#passing-parameters-into-raw" title="永久链接至标题">¶</a></h3>
<p>如果你需要执行参数化的查询，可以使用 <code class="docutils literal notranslate"><span class="pre">raw()</span></code> 的 <code class="docutils literal notranslate"><span class="pre">params</span></code> 参数:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">lname</span> <span class="o">=</span> <span class="s1">&#39;Doe&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="s1">&#39;SELECT * FROM myapp_person WHERE last_name = </span><span class="si">%s</span><span class="s1">&#39;</span><span class="p">,</span> <span class="p">[</span><span class="n">lname</span><span class="p">])</span>
</pre></div>
</div>
<p><code class="docutils literal notranslate"><span class="pre">params</span></code> 是一个参数字典。你将用一个列表替换查询字符串中 <code class="docutils literal notranslate"><span class="pre">%s</span></code> 占位符，或用字典替换 <code class="docutils literal notranslate"><span class="pre">%(key)s</span></code> 占位符（<code class="docutils literal notranslate"><span class="pre">key</span></code> 被字典 key 替换），不论你使用哪个数据库引擎。这些占位符会被 <code class="docutils literal notranslate"><span class="pre">params</span></code> 参数的值替换。</p>
<div class="admonition note">
<p class="first admonition-title">注解</p>
<p class="last">使用 SQLite 后端时不支持字典参数；使用此后端时，你必须以列表形式传入参数。</p>
</div>
<div class="admonition warning">
<p class="first admonition-title">警告</p>
<p><strong>不要对原生查询或 SQL 字符串中的引号占位符使用字符串格式化！</strong></p>
<p>临时将上述查询写作:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">query</span> <span class="o">=</span> <span class="s1">&#39;SELECT * FROM myapp_person WHERE last_name = </span><span class="si">%s</span><span class="s1">&#39;</span> <span class="o">%</span> <span class="n">lname</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">Person</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">raw</span><span class="p">(</span><span class="n">query</span><span class="p">)</span>
</pre></div>
</div>
<p>你可能认为你需要将查询写成这样（用单引号包裹 <code class="docutils literal notranslate"><span class="pre">%s</span></code>）:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">query</span> <span class="o">=</span> <span class="s2">&quot;SELECT * FROM myapp_person WHERE last_name = &#39;</span><span class="si">%s</span><span class="s2">&#39;&quot;</span>
</pre></div>
</div>
<p><strong>不要犯其它错误。</strong></p>
<p class="last">正如 <a class="reference internal" href="../security.html#sql-injection-protection"><span class="std std-ref">防御 SQL 注入</span></a> 介绍的，使用 <code class="docutils literal notranslate"><span class="pre">params</span></code> 参数和不用引号包裹占位符使你免受 <a class="reference external" href="https://en.wikipedia.org/wiki/SQL_injection">SQL 注入攻击</a>，这是一个攻击者常用的漏洞，将任意 SQL 注入你的数据库。若你使用了字符串插入或用引号包裹占位符，你正处于 SQL 注入的风险中。</p>
</div>
</div>
</div>
<div class="section" id="s-executing-custom-sql-directly">
<span id="s-executing-custom-sql"></span><span id="executing-custom-sql-directly"></span><span id="executing-custom-sql"></span><h2>直接执行自定义 SQL<a class="headerlink" href="#executing-custom-sql-directly" title="永久链接至标题">¶</a></h2>
<p>有时候，甚至 <a class="reference internal" href="#django.db.models.Manager.raw" title="django.db.models.Manager.raw"><code class="xref py py-meth docutils literal notranslate"><span class="pre">Manager.raw()</span></code></a> 都无法满足需求：你可能要执行不明确映射至模型的查询语句，或者就是直接执行 <code class="docutils literal notranslate"><span class="pre">UPDATE</span></code>， <code class="docutils literal notranslate"><span class="pre">INSERT</span></code> 或 <code class="docutils literal notranslate"><span class="pre">DELETE</span></code> 语句。</p>
<p>这些情况下，你总是能直接访问数据库，完全绕过模型层。</p>
<p>对象 <code class="docutils literal notranslate"><span class="pre">django.db.connection</span></code> 代表默认数据库连接。要使用这个数据库连接，调用 <code class="docutils literal notranslate"><span class="pre">connection.cursor()</span></code> 来获取一个指针对象。然后，调用 <code class="docutils literal notranslate"><span class="pre">cursor.execute(sql,</span> <span class="pre">[params])</span></code> 来执行该 SQL 和 <code class="docutils literal notranslate"><span class="pre">cursor.fetchone()</span></code>，或 <code class="docutils literal notranslate"><span class="pre">cursor.fetchall()</span></code> 获取结果数据。</p>
<p>例如:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">django.db</span> <span class="kn">import</span> <span class="n">connection</span>

<span class="k">def</span> <span class="nf">my_custom_sql</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
    <span class="k">with</span> <span class="n">connection</span><span class="o">.</span><span class="n">cursor</span><span class="p">()</span> <span class="k">as</span> <span class="n">cursor</span><span class="p">:</span>
        <span class="n">cursor</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="s2">&quot;UPDATE bar SET foo = 1 WHERE baz = </span><span class="si">%s</span><span class="s2">&quot;</span><span class="p">,</span> <span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">baz</span><span class="p">])</span>
        <span class="n">cursor</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="s2">&quot;SELECT foo FROM bar WHERE baz = </span><span class="si">%s</span><span class="s2">&quot;</span><span class="p">,</span> <span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">baz</span><span class="p">])</span>
        <span class="n">row</span> <span class="o">=</span> <span class="n">cursor</span><span class="o">.</span><span class="n">fetchone</span><span class="p">()</span>

    <span class="k">return</span> <span class="n">row</span>
</pre></div>
</div>
<p>要避免 SQL 注入，你绝对不能在 SQL 字符串中用引号包裹  <code class="docutils literal notranslate"><span class="pre">%s</span></code> 占位符。</p>
<p>注意，若要在查询中包含文本的百分号，你需要在传入参数使用两个百分号:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">cursor</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="s2">&quot;SELECT foo FROM bar WHERE baz = &#39;30%&#39;&quot;</span><span class="p">)</span>
<span class="n">cursor</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="s2">&quot;SELECT foo FROM bar WHERE baz = &#39;30</span><span class="si">%%</span><span class="s2">&#39; AND id = </span><span class="si">%s</span><span class="s2">&quot;</span><span class="p">,</span> <span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">])</span>
</pre></div>
</div>
<p>若你同时使用 <a class="reference internal" href="multi-db.html"><span class="doc">不止一个数据库</span></a>，你可以使用 <code class="docutils literal notranslate"><span class="pre">django.db.connections</span></code> 获取指定数据库的连接（和指针）。 <code class="docutils literal notranslate"><span class="pre">django.db.connections</span></code> 是一个类字典对象，它允许你通过连接别名获取指定连接:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">django.db</span> <span class="kn">import</span> <span class="n">connections</span>
<span class="k">with</span> <span class="n">connections</span><span class="p">[</span><span class="s1">&#39;my_db_alias&#39;</span><span class="p">]</span><span class="o">.</span><span class="n">cursor</span><span class="p">()</span> <span class="k">as</span> <span class="n">cursor</span><span class="p">:</span>
    <span class="c1"># Your code here...</span>
</pre></div>
</div>
<p>默认情况下，Python DB API 返回的结果不会包含字段名，这意味着你最终会收到一个 <code class="docutils literal notranslate"><span class="pre">list</span></code>，而不是一个 <code class="docutils literal notranslate"><span class="pre">dict</span></code>。要追求较少的运算和内存消耗，你可以以 <code class="docutils literal notranslate"><span class="pre">dict</span></code> 返回结果，通过使用如下的玩意:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">dictfetchall</span><span class="p">(</span><span class="n">cursor</span><span class="p">):</span>
    <span class="s2">&quot;Return all rows from a cursor as a dict&quot;</span>
    <span class="n">columns</span> <span class="o">=</span> <span class="p">[</span><span class="n">col</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="k">for</span> <span class="n">col</span> <span class="ow">in</span> <span class="n">cursor</span><span class="o">.</span><span class="n">description</span><span class="p">]</span>
    <span class="k">return</span> <span class="p">[</span>
        <span class="nb">dict</span><span class="p">(</span><span class="nb">zip</span><span class="p">(</span><span class="n">columns</span><span class="p">,</span> <span class="n">row</span><span class="p">))</span>
        <span class="k">for</span> <span class="n">row</span> <span class="ow">in</span> <span class="n">cursor</span><span class="o">.</span><span class="n">fetchall</span><span class="p">()</span>
    <span class="p">]</span>
</pre></div>
</div>
<p>另一个选项是使用来自 Python 标准库的 <a class="reference external" href="https://docs.python.org/3/library/collections.html#collections.namedtuple" title="(在 Python v3.10)"><code class="xref py py-func docutils literal notranslate"><span class="pre">collections.namedtuple()</span></code></a>。 <code class="docutils literal notranslate"><span class="pre">namedtuple</span></code> 是一个类元组对象，可以通过属性查找来访问其包含的字段；也能通过索引和迭代。结果都是不可变的，但能通过字段名或索引访问，这很实用:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">collections</span> <span class="kn">import</span> <span class="n">namedtuple</span>

<span class="k">def</span> <span class="nf">namedtuplefetchall</span><span class="p">(</span><span class="n">cursor</span><span class="p">):</span>
    <span class="s2">&quot;Return all rows from a cursor as a namedtuple&quot;</span>
    <span class="n">desc</span> <span class="o">=</span> <span class="n">cursor</span><span class="o">.</span><span class="n">description</span>
    <span class="n">nt_result</span> <span class="o">=</span> <span class="n">namedtuple</span><span class="p">(</span><span class="s1">&#39;Result&#39;</span><span class="p">,</span> <span class="p">[</span><span class="n">col</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="k">for</span> <span class="n">col</span> <span class="ow">in</span> <span class="n">desc</span><span class="p">])</span>
    <span class="k">return</span> <span class="p">[</span><span class="n">nt_result</span><span class="p">(</span><span class="o">*</span><span class="n">row</span><span class="p">)</span> <span class="k">for</span> <span class="n">row</span> <span class="ow">in</span> <span class="n">cursor</span><span class="o">.</span><span class="n">fetchall</span><span class="p">()]</span>
</pre></div>
</div>
<p>这有个例子，介绍了三者之间的不同:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">cursor</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="s2">&quot;SELECT id, parent_id FROM test LIMIT 2&quot;</span><span class="p">);</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">cursor</span><span class="o">.</span><span class="n">fetchall</span><span class="p">()</span>
<span class="go">((54360982, None), (54360880, None))</span>

<span class="gp">&gt;&gt;&gt; </span><span class="n">cursor</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="s2">&quot;SELECT id, parent_id FROM test LIMIT 2&quot;</span><span class="p">);</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">dictfetchall</span><span class="p">(</span><span class="n">cursor</span><span class="p">)</span>
<span class="go">[{&#39;parent_id&#39;: None, &#39;id&#39;: 54360982}, {&#39;parent_id&#39;: None, &#39;id&#39;: 54360880}]</span>

<span class="gp">&gt;&gt;&gt; </span><span class="n">cursor</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="s2">&quot;SELECT id, parent_id FROM test LIMIT 2&quot;</span><span class="p">);</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">results</span> <span class="o">=</span> <span class="n">namedtuplefetchall</span><span class="p">(</span><span class="n">cursor</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">results</span>
<span class="go">[Result(id=54360982, parent_id=None), Result(id=54360880, parent_id=None)]</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">results</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">id</span>
<span class="go">54360982</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">results</span><span class="p">[</span><span class="mi">0</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
<span class="go">54360982</span>
</pre></div>
</div>
<div class="section" id="s-connections-and-cursors">
<span id="connections-and-cursors"></span><h3>连接和指针<a class="headerlink" href="#connections-and-cursors" title="永久链接至标题">¶</a></h3>
<p><code class="docutils literal notranslate"><span class="pre">connection</span></code> 和 <code class="docutils literal notranslate"><span class="pre">cursor</span></code> 实现了 <span class="target" id="index-2"></span><a class="pep reference external" href="https://www.python.org/dev/peps/pep-0249"><strong>PEP 249</strong></a> 中介绍的大部分标准 Python DB-API —— 除了 <a class="reference internal" href="transactions.html"><span class="doc">事务处理</span></a> 之外。</p>
<p>若你并不熟悉 Python DB-API，要注意 <code class="docutils literal notranslate"><span class="pre">cursor.execute()</span></code> 中的 SQL 语句使用了占位符 <code class="docutils literal notranslate"><span class="pre">&quot;%s&quot;</span></code>，而不是直接在 SQL 中添加参数。若你使用这个技巧，潜在的数据库库会自动在需要时转义参数。</p>
<p>也要注意，Django 期望 <code class="docutils literal notranslate"><span class="pre">&quot;%s&quot;</span></code> 占位符，而 <em>不是</em> <code class="docutils literal notranslate"><span class="pre">&quot;?&quot;</span></code> 占位符，后者由 SQLite Python 绑定使用。这是为了一致性和正确性。</p>
<p>将指针作为上下文的管理器:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">with</span> <span class="n">connection</span><span class="o">.</span><span class="n">cursor</span><span class="p">()</span> <span class="k">as</span> <span class="n">c</span><span class="p">:</span>
    <span class="n">c</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="o">...</span><span class="p">)</span>
</pre></div>
</div>
<p>相当于:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">c</span> <span class="o">=</span> <span class="n">connection</span><span class="o">.</span><span class="n">cursor</span><span class="p">()</span>
<span class="k">try</span><span class="p">:</span>
    <span class="n">c</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="o">...</span><span class="p">)</span>
<span class="k">finally</span><span class="p">:</span>
    <span class="n">c</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
</pre></div>
</div>
<div class="section" id="s-calling-stored-procedures">
<span id="calling-stored-procedures"></span><h4>调用存储流程<a class="headerlink" href="#calling-stored-procedures" title="永久链接至标题">¶</a></h4>
<dl class="method">
<dt id="django.db.models.CursorWrapper.callproc">
<code class="descclassname">CursorWrapper.</code><code class="descname">callproc</code>(<em>procname</em>, <em>params=None</em>, <em>kparams=None</em>)<a class="headerlink" href="#django.db.models.CursorWrapper.callproc" title="永久链接至目标">¶</a></dt>
<dd><p>以给定名称调用数据库存储流程。要提供一个序列 (<code class="docutils literal notranslate"><span class="pre">params</span></code>) 或字典 (<code class="docutils literal notranslate"><span class="pre">kparams</span></code>) 作为输入参数。大多数数据库不支持 <code class="docutils literal notranslate"><span class="pre">kparams</span></code>。对于 Django 内置后端来说，只有 Oracle 支持。</p>
<p>例如，在一个 Oracle 数据库中指定存储流程：</p>
<div class="highlight-sql notranslate"><div class="highlight"><pre><span></span><span class="k">CREATE</span> <span class="k">PROCEDURE</span> <span class="ss">&quot;TEST_PROCEDURE&quot;</span><span class="p">(</span><span class="n">v_i</span> <span class="nb">INTEGER</span><span class="p">,</span> <span class="n">v_text</span> <span class="n">NVARCHAR2</span><span class="p">(</span><span class="mi">10</span><span class="p">))</span> <span class="k">AS</span>
    <span class="n">p_i</span> <span class="nb">INTEGER</span><span class="p">;</span>
    <span class="n">p_text</span> <span class="n">NVARCHAR2</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
<span class="k">BEGIN</span>
    <span class="n">p_i</span> <span class="p">:</span><span class="o">=</span> <span class="n">v_i</span><span class="p">;</span>
    <span class="n">p_text</span> <span class="p">:</span><span class="o">=</span> <span class="n">v_text</span><span class="p">;</span>
    <span class="p">...</span>
<span class="k">END</span><span class="p">;</span>
</pre></div>
</div>
<p>这将调用该存储流程:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">with</span> <span class="n">connection</span><span class="o">.</span><span class="n">cursor</span><span class="p">()</span> <span class="k">as</span> <span class="n">cursor</span><span class="p">:</span>
    <span class="n">cursor</span><span class="o">.</span><span class="n">callproc</span><span class="p">(</span><span class="s1">&#39;test_procedure&#39;</span><span class="p">,</span> <span class="p">[</span><span class="mi">1</span><span class="p">,</span> <span class="s1">&#39;test&#39;</span><span class="p">])</span>
</pre></div>
</div>
</dd></dl>

</div>
</div>
</div>
</div>


          </div>
        </div>
      </div>
      
        
          <div class="yui-b" id="sidebar">
            
      <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
        <div class="sphinxsidebarwrapper">
  <h3><a href="../../contents.html">Table of Contents</a></h3>
  <ul>
<li><a class="reference internal" href="#">执行原生 SQL 查询</a><ul>
<li><a class="reference internal" href="#performing-raw-queries">执行原生查询</a><ul>
<li><a class="reference internal" href="#mapping-query-fields-to-model-fields">将查询字段映射为模型字段</a></li>
<li><a class="reference internal" href="#index-lookups">索引查询</a></li>
<li><a class="reference internal" href="#deferring-model-fields">延迟模型字段</a></li>
<li><a class="reference internal" href="#adding-annotations">添加注释</a></li>
<li><a class="reference internal" href="#passing-parameters-into-raw">将参数传给 <code class="docutils literal notranslate"><span class="pre">raw()</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#executing-custom-sql-directly">直接执行自定义 SQL</a><ul>
<li><a class="reference internal" href="#connections-and-cursors">连接和指针</a><ul>
<li><a class="reference internal" href="#calling-stored-procedures">调用存储流程</a></li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>

  <h4>上一个主题</h4>
  <p class="topless"><a href="managers.html"
                        title="上一章">管理器</a></p>
  <h4>下一个主题</h4>
  <p class="topless"><a href="transactions.html"
                        title="下一章">数据库事务</a></p>
  <div role="note" aria-label="source link">
    <h3>本页</h3>
    <ul class="this-page-menu">
      <li><a href="../../_sources/topics/db/sql.txt"
            rel="nofollow">显示源代码</a></li>
    </ul>
   </div>
<div id="searchbox" style="display: none" role="search">
  <h3>快速搜索</h3>
    <div class="searchformwrapper">
    <form class="search" action="../../search.html" method="get">
      <input type="text" name="q" />
      <input type="submit" value="转向" />
      <input type="hidden" name="check_keywords" value="yes" />
      <input type="hidden" name="area" value="default" />
    </form>
    </div>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
        </div>
      </div>
              <h3>Last update:</h3>
              <p class="topless">12月 07, 2021</p>
          </div>
        
      
    </div>

    <div id="ft">
      <div class="nav">
    &laquo; <a href="managers.html" title="管理器">previous</a>
     |
    <a href="../index.html" title="使用 Django" accesskey="U">up</a>
   |
    <a href="transactions.html" title="数据库事务">next</a> &raquo;</div>
    </div>
  </div>

      <div class="clearer"></div>
    </div>
  </body>
</html>